In brief
Give every bidder the same requirement and distinguish mandatory conditions from weighted preferences. First establish whether an offer is eligible. Then compare the eligible offers using stated criteria and evidence. An attractive price should not silently compensate for an omitted deliverable, an unresolved responsibility or an unacceptable exclusion.
1 Define the outcome and a shared scope
Begin with the decision behind the purchase: preparing a service for launch, addressing an assessment finding or improving incident operations. Describe what successful delivery would let your team decide or do. ‘Comprehensive protection’ is not an acceptance criterion.
Illustrative requirement: ‘Assess our customer portal and software interfaces within agreed boundaries, provide validated findings and remediation guidance, and retest the selected fixes.’ This fictional brief is an example of scope wording, not a statement about a real engagement.
| Field | Information to provide |
|---|---|
| Environment | Applications, locations, cloud environments and infrastructure |
| Scale and access | Known asset counts, user roles and available documentation |
| Boundaries | Exclusions, third-party dependencies and permitted activity |
| Operating constraints | Availability requirements, access windows and internal dependencies |
| Completion evidence | Deliverables, acceptance owner and review method |
Mark uncertain quantities. Ask every bidder to state assumptions and how discovery of additional scope changes the proposal. Share sensitive detail through a controlled process; do not include credentials in the invitation.
2 Define responsibilities and acceptable evidence
The UK National Cyber Security Centre’s (NCSC) managed-provider guidance recommends explicit responsibilities and incident-reporting arrangements. The US National Institute of Standards and Technology’s (NIST) supply-chain guidance addresses identifying, assessing and mitigating supplier-related cybersecurity risks. These are foundations for due diligence, not a universal tender template.
Source: UK National Cyber Security Centre. Choosing a managed service provider
Source: US National Institute of Standards and Technology. Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
For each material activity, record who performs it, who approves it and who receives escalation. Cover access, changes, reporting, containment or remediation where relevant, and the return or deletion of engagement information at exit.
Ask for an appropriate redacted deliverable. For an assessment, evaluate whether the sample explains the affected asset, evidence, impact, proposed action and limitations. For an operating service, ask how coverage and escalation would be demonstrated. A document called a report is not automatically usable evidence.
3 Apply mandatory conditions before scoring preferences
Use an eligibility screen for conditions the purchase cannot proceed without. Set them before bids arrive and define how compliance will be evidenced. Examples include a required assessment scope, an acceptable data-handling condition or an essential retest deliverable. Confirm any legal or accreditation requirement separately against the applicable primary text.
Our suggested preference model is below. The weights and rating anchors are illustrative editorial choices, not a research finding or established procurement standard. Adapt them to the purchase before evaluating responses.
| Criterion | Weight | Evidence to examine |
|---|---|---|
| Requirement and scope fit | 25% | Coverage, assumptions and exclusions |
| Method and team capability | 25% | Relevant proposed approach and team evidence |
| Deliverables and acceptance | 20% | Sample outputs and completion checks |
| Responsibilities and safeguards | 15% | Ownership, escalation and data handling |
| Total evaluated cost | 15% | Included fees, options and retained internal work |
For each criterion, use a documented zero-to-four rating: zero means no usable response; one leaves material gaps; two substantially meets the criterion with conditions; three meets it with adequate evidence; four meets it with clearly demonstrated additional relevant value. Calibrate what those anchors mean for your requirement before scoring. Calculate a weighted result as the sum of each criterion’s weight multiplied by its rating divided by four.
4 Test the method with a fictional proposal comparison
Imagine retesting selected fixes is mandatory. Proposal A offers an attractive assessment fee but excludes retesting. Proposal B includes it but leaves its evidence-handling terms unclear. Neither should be declared the winner from a weighted total alone.
Ask A to clarify whether it can meet the requirement within the procurement rules. Ask B to resolve the terms before eligibility is confirmed. Only then score the eligible final offers against the same criteria. The example demonstrates the sequence, not the quality of any real provider.
An exception should be an explicit decision by the authorised buyer, with its consequences recorded. Do not quietly reduce a mandatory condition to a preference after seeing an appealing proposal.
5 Keep the evaluation useful after award
The NCSC’s supply-chain principles include checking arrangements and continual improvement. Use the accepted scope, responsibilities and deliverables as the starting record for service reviews, rather than discarding them once procurement ends.
Source: UK National Cyber Security Centre. The principles of supply chain security
Before signature, resolve what is excluded, what your team must supply, how scope changes are approved and what happens at termination. Keep the final answers with the decision record. If the purchase is small and clearly defined, a concise scope brief may be more proportionate than a long RFP; retain the same discipline around acceptance and ownership.
What should you do now
- Service owner: define the outcome and acceptance evidence.
- Security lead: state essential scope and safeguards.
- Procurement: agree eligibility, scoring anchors and clarification rules before inviting bids.
- Budget owner: compare equivalent work and retained internal effort.
- Contract owner: carry the accepted requirement into delivery reviews.
India and Australia context
For an Indian audit engagement, CERT-In’s 2025 audit guidance identifies scope elements including audit type, assets, reporting, data handling and timelines. Check its applicability to the engagement rather than assuming it governs every purchase.
Source: Indian Computer Emergency Response Team (CERT-In). Comprehensive Cyber Security Audit Policy Guidelines
Australian government vulnerability-disclosure guidance also addresses who tests, what is in scope, confidentiality and how findings are communicated. Use these planning questions to clarify the engagement; the guidance does not establish a universal service package.
Source: Australian Government cyber.gov.au. Vulnerability disclosure programs explained
How Bravewall helps
Bravewall helps define security requirements and coordinate capability and delivery ownership. Services and how we work
This article is general information for awareness and education. It is not legal, regulatory or professional advice and does not take into account the circumstances of your organisation. Laws, standards and threats change; check the primary sources cited and take qualified advice before acting.